PDF Privacy Checklist for EU Teams

Begin by recording why each document is processed, who may access it and how long it must be retained. Check whether the selected workflow transfers the file to another server or processes it locally in the browser, and verify that behavior against the provider's current documentation. Limit access to people who need the document, keep the original and edited versions under an appropriate retention policy, and test any redaction on the exported copy before distribution. Record the tools, recipients and deletion steps used for sensitive files. These checks can reduce exposure, but they do not determine a lawful basis or establish GDPR compliance for an organisation; those conclusions depend on the complete processing context and should be reviewed by the responsible privacy role.